Nmap: More port scanning techniques

In this fifth tip in our Nmap manual, SearchSecurity.com expert Michael Cobb looks at some of the Nmap port scanning techniques that exploit certain idiosyncrasies of specific platforms or protocols in order to better differentiate between open and closed ports.

By submitting your personal information, you agree to receive emails regarding relevant products and special offers from TechTarget and its partners. You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

In our last tip we looked at the basic Nmap commands for scanning network machines and services. In this tip I want to look at some of the scans that exploit certain idiosyncrasies of specific platforms or protocols in order to better differentiate between open and closed ports.

Nmap's TCP Null (option –sN), FIN (option –sF) and Xmas (option –sX) scans exploit a subtle loophole in the TCP protocol specification as described in RFC 793. When scanning systems compliant with this RFC (such as most Unix-based systems), any packet not containing set SYN, RST or ACK bits will result in a returned RST (reset) packet if the port is closed, and no response at all if the port is open. If a RST packet is received, the port is considered closed, while no response means it is open or possibly filtered. The key advantage to these scans is that they can pass through certain non-stateful firewalls and packet-filtering routers.

Another scan that can bypass packet filters in certain circumstances is the IPID Idle scan (option -sI). By using another device on the network, commonly called a zombie, Nmap's Idlescan can gather port information from a remote device without having to send it a single packet from its own IP address. Any intrusion detection system (IDS) will report the innocent zombie as the attacker but of more importance is that this scan can be used to map out IP-based trust relationships between machines, because the Idlescan results show open ports from the zombie machine's perspective. So for example, a normal scan against a database server might show no ports open, but by using a file server IP as the zombie the database-related service ports on the database server may show open and expose a trust relationship. If by using Nmap to explore your network you realize that it's susceptible to IPID-related attacks, then you need to configure or adjust your firewall and router rules to deny incoming packets with bogus source addresses. Also, you should enable egress filtering to prevent spoofed packets from leaving your network to prevent your internal users from launching this type of attack.

Nmap provides another scan, the TCP ACK scan (option -sA), to help map out firewall rule sets. This scan doesn't determine whether a port is open or closed, but it can tell if it's filtered and whether the device filtering the port is stateful or not. We will look at firewall evasion in the next tip, but in the meantime, you can experiment probing and analysing your firewalls and network by sending a variety of probe types with different flag settings. Even though Nmap includes several different scans, you can design your own scan by specifying arbitrary TCP flags using the Custom TCP scan (option --scanflags). For example, you can run a SYN|FIN scan with the command:

About the author:Michael Cobb, CISSP-ISSAP, is a renowned security author with over 20 years of experience in the IT industry. He has a passion for making IT security best practices easier to understand and achievable. His website http://www.hairyitdog.com offers free security posters to raise employee awareness of the importance of safeguarding company and client data and of following good practices. He co-authored the book IIS Security and has written many technical articles for leading IT publications. Mike has also been a Microsoft Certified Database Manager and registered consultant with the CESG Listed Advisor Scheme (CLAS).

E-Zine

0 comments

E-Mail

Username / Password

Password

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy